Global Digital Asset Threat Report, Q2 2026

Evidence tier: A1 Evidence type: Auto-discovered official publication Source: Fireblocks Blog Official publication date: 2026-07-28 Captured: 2026-08-03T05:09:17.295Z

By Ori Hershko, Threat Research Team Lead, and Ziv Bilgory Gretz, Threat Researcher — Security & Trust Products

Executive Summary

Stablecoins and tokenized assets moved decisively into mainstream operations this quarter. Adoption is expanding on two fronts at once: financial institutions building on tokenized deposits, reserve funds, and settlement rails, and non-financial enterprises adopting stablecoins for cross-border payments and treasury operations. Use cases have matured, spanning cross-border settlement, bank and asset manager tokenization, and payment networks, and they are driving significant volume. Stablecoin transaction volume reached a record $1.79 trillion in June alone, up 63% month over month.

As capital and activity have grown, so has adversary attention. The frequency, sophistication, and breadth of attacks increased in Q2 2026, with April as the standout month: over $650 million in confirmed losses across a cluster of incidents. Importantly, technology failures alone did not drive these losses. Across the quarter, the incidents that caused the most damage exploited gaps in internal awareness, operational process, and infrastructure decisions.

This report aims to surface and summarize notable recent exploits in the digital asset landscape, identifying key trends in attack vectors and providing insights into how businesses can better protect themselves.

Trends & Key Takeaways

1. DPRK actors are running a sustained, parallel, multi-vector campaign, focusing on social engineering. Three confirmed DPRK-linked operations occurred in April alone, each targeting a different layer of the crypto stack: governance (Drift), developer devices (Zerion), and verification infrastructure (KelpDAO). These groups commit significant resources over months, running sophisticated HUMINT operations that include in-person meetings and capital investments, and they deploy AI-enhanced social engineering against institutional-grade protocols specifically. The Humanity Protocol breach traced initial access to a Bithumb phishing email that delivered Hancom-signed remote-access malware to a director’s device, with all keys used in the attack coming from a single compromised laptop. Tactics proven effective by DPRK actors are increasingly adopted by other threat groups, with Russia-based operators running Malware-as-a-Service infostealer campaigns observed replicating DPRK social engineering methods (Security Alliance).

2. AI-enhanced social engineering is increasingly being used in multi-stage attacks targeting infrastructure. In the CoW Swap attack, attackers faked financial records using AI while impersonating a senior contributor contacting the Finnish Communications Regulatory Authority, initiating a domain transfer process that ultimately moved the protocol’s domain to attacker-controlled infrastructure. AI also emerged as an attack surface in its own right, as seen in the PromptMink campaign targeting AI coding agents. A further example is the Bankr bot incident, in which an attacker prompt injected xAI’s Grok and triggered an unauthorized onchain transfer without human oversight.

3. The KelpDAO exploit centered on a single verification path. A 1-of-1 DVN (Decentralized Verifier Network) configuration on LayerZero’s bridge meant one entity was responsible for verifying cross-chain message validity, leaving no independent check once that path was compromised through social engineering. The broader architectural lesson is that verification layers that depend on a single verifier concentrate risk, while multi-verifier configurations reduce risk. The incident also underscores the security risks inherent in any third-party dependency, where organizations can inherit a provider’s threat surface without full visibility into it.

4. Blind signing remains a persistent attack vector against multisig governance in cryptocurrency protocols. Attackers obtain valid signatures by deceiving or manipulating signers into approving transactions whose actual content they do not fully understand. Blind signing has been a persistent attack vector across the industry, with prior examples including the WazirX ($234M, July 2024) and Bybit ($1.46B, February 2025) incidents. The most recent example is the Drift Protocol exploit, in which DPRK-linked actors induced its governing council to pre-sign malicious governance transactions that were executed weeks later.

5. Several incidents this quarter stemmed from private key compromise, including StablR and Polymarket. In the StablR case, the exploited configuration was a minting multisig that required only a single signature to execute administrative actions, allowing one compromised key to add an attacker as contract owner and remove the legitimate signers. Separately, THORChain experienced an exploit that traced to a known vulnerability in the GG20 threshold signature scheme, first documented publicly around two years ago, which allows partial key material to leak across repeated signing ceremonies. An attacker exploited this by operating a malicious validator node to reconstruct a full vault private key over two days of routine signing. Notably, this reflects a weakness in the specific GG20 implementation rather than in MPC or threshold-signature schemes as a category, and modern protocols incorporate zero-knowledge proofs and additional checks that address it.

Building Resilience: What Organizations Can Do

The incidents this quarter share a common lesson: the strongest technical infrastructure can still be undermined by a compromised laptop, a deceived signer, or an unvetted third-party dependency. Protecting digital asset operations requires defense across three layers, people, process, and technology.

• People and awareness: The majority of this quarter’s largest losses began with social engineering. Continuous team training, strict verification of external contacts, and awareness of active campaigns targeting customer-facing and technical staff are frontline defenses.
• Secure processes: Blind signing, single-signature administrative actions, and unmonitored privileged keys turned recoverable situations into major losses. Enforcing transaction transparency, multi-party approvals, and least-privilege access materially reduces exposure.
• Secure technology decisions: Verification architecture, key management protocols, and third-party dependencies each carry inherited risk. Choosing infrastructure with independent verification, modern MPC with zero-knowledge proofs, and policy controls enforced before signing can help close the gaps most frequently exploited this quarter.

At Fireblocks, the digital asset infrastructure we deliver to our customers is grounded in a defense-in-depth approach to security. For a full breakdown of the defense-in-depth framework and how it can apply to your business, read the report here and download this security checklist.

April

May

June